CVE-2012-3442
The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-78vx-ggch-wghm | PyPI | django | <1.3.2 | 1.3.2 |
| GHSA-78vx-ggch-wghm | PyPI | django | >=1.4 <1.4.1 | 1.4.1 |
| PYSEC-2012-2 | PyPI | django | <1.3.2 >=1.4 <1.4.1 | 1.3.2, 1.4.1 |